Skip to content
HackIndex.io

PT2 · Module 12

Cloud Security Bypass

Enumerate AWS IAM, steal credentials via SSRF to IMDS, escalate through PassRole plus Lambda, and abuse OIDC federation to assume roles from outside the account.

~10 h 10 resources Last updated October 4, 2026

Cloud environments move the attack surface from kernel and network to API and IAM policy. The exam rewards treating AWS as a graph of principals, roles, and trust policies: enumerate what you can see, find the one permission that unlocks the next role, and chain assume-role calls until a role with the sensitive access is yours. PT2 tests one cloud (AWS) in depth; the primitives (IMDS, metadata, trust policy, PassRole) have direct equivalents on GCP and Azure.

Credential Discovery

Every AWS compromise starts with a credential. Long-term access keys leaked in Git, S3 buckets, environment variables, or build artefacts. Temporary session credentials from IMDS on a compromised EC2 instance. Role credentials from an SSRF against the instance metadata endpoint at 169.254.169.254. Web identity tokens from a mis-scoped OIDC trust. The credential resolution chain (env vars → shared credentials file → container role → instance role) explains why one leaked value often implicates several roles.

Enumeration

Unauthenticated: account ID leaks from public S3 buckets, AMIs, ECR repos, and sts:AssumeRole error messages. Role name enumeration via SSH-style error discrimination. Authenticated: get-caller-identity, then enumerate every IAM entity you can touch. Lambda function listings expose environment variables (frequently used for secrets injection) and execution roles. Secrets Manager and SSM Parameter Store hold credentials, API keys, and connection strings scoped by key name alone.

IMDS And SSRF Chains

SSRF against a web application on EC2 reaches the metadata service. IMDSv1 responds without any header; IMDSv2 requires a PUT to get a token first, trivially bypassed when the SSRF supports PUT or when the request pipeline sets the token header itself. The response gives you the role's short-lived credentials, which inherit everything the role is attached to.

Privilege Escalation

IAM has a dozen escalation primitives. The classic: iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction → attach a higher-privilege role to a Lambda you write, invoke it, run arbitrary code as that role. Equivalent paths for EC2, CodeBuild, Glue, and ECS. Writeable managed-policy versions, misconfigured sts:AssumeRole trust policies with wildcard principals, and over-permissive permission boundaries all collapse to privilege escalation.

OIDC Federation

Trust policies that federate to external identity providers (GitHub Actions, EKS IRSA, generic OIDC) often fail to pin the subject claim precisely. If you can mint an OIDC token with a matching subject (your own GitHub repo named after the trusted one, a forked workflow, an IRSA service account you can create), you assume the role from outside the account entirely, no leaked keys needed.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Practice

Apply the module hands-on.

All PT2 practice machines